What is the CVSS score of CVE-2026-60972?

CVE-2026-60972 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle E-Business Tax are affected by CVE-2026-60972?

Oracle E-Business Tax (versions 12.2.3-12.2.15 in E-Business Suite) is vulnerable to data compromise by low-privileged authenticated users who can read, modify, and delete all accessible tax data.

How to fix or mitigate CVE-2026-60972?

Within 24 hours: Identify all systems running Oracle E-Business Suite versions 12.2.3-12.2.15 and document their criticality and tax data volume; note that no public exploit identified at time of analysis, but the vulnerability requires only low-privileged user access, creating broad internal risk. Audit access logs for unexpected modifications to tax data and review low-privileged user account privileges. Within 7 days: Implement network-level access restrictions to the E-Business Tax module; apply principle of least privilege to revoke unnecessary data access for low-privileged accounts; enable enhanced logging on all tax data queries and modifications. Within 30 days: Apply Oracle's July 2026 Critical Patch Update when available; if unable to patch immediately, deploy application-level access controls limiting low-privileged user permissions on tax-related database tables.

Oracle E-Business Tax CVE-2026-60972

EUVD-2026-47219 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-gf57-h8xx-7g55

Authentication Bypass Oracle E Business Tax

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network HTTP access with a low-privilege authenticated account and no user interaction yields high confidentiality and integrity impact, with no availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:21 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle E-Business Tax product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Tax. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle E-Business Tax accessible data as well as unauthorized access to critical data or complete access to all Oracle E-Business Tax accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Remote data compromise in Oracle E-Business Tax (Oracle E-Business Suite, Internal Operations component) allows a low-privileged authenticated attacker with HTTP network access to read, create, delete, or modify all E-Business Tax accessible data. Affecting supported versions 12.2.3 through 12.2.15, the flaw carries a CVSS 3.1 base score of 8.1 with high confidentiality and integrity impact but no availability impact. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; it was reported by Oracle's own security team and addressed in the July 2026 Critical Patch Update.

Technical ContextAI

Oracle E-Business Tax is the centralized tax engine within Oracle E-Business Suite (EBS), a large enterprise ERP platform that manages tax setup, calculation, and reporting across financials, procurement, and order management modules. The affected 'Internal Operations' component is exposed over HTTP through the EBS application tier (typically Oracle Application Server / WebLogic fronting the Forms and self-service web applications). The vendor tag 'Authentication Bypass' combined with the PR:L vector suggests an authorization or access-control weakness where an already-authenticated low-privilege user can reach data and operations beyond their intended scope. No CWE was assigned in the source data, but the pattern (a logged-in user gaining unauthorized read/write to all module-accessible data) is consistent with a broken access control / improper authorization root cause rather than an unauthenticated pre-auth bypass.

RemediationAI

Apply the Oracle July 2026 Critical Patch Update (CPU), which contains the fix for this issue, as documented at https://www.oracle.com/security-alerts/cpujul2026.html; treat this as patch available per vendor advisory, as the input provides the CPU reference but no discrete component patch version number to cite. Because Oracle EBS patches are cumulative and delivered as CPU bundles, prioritize scheduling the July 2026 CPU across all 12.2.3-12.2.15 environments. Where immediate patching is not feasible, apply compensating controls: restrict network reachability of the EBS application tier and the E-Business Tax / Internal Operations endpoints to trusted internal networks or VPN only (trade-off: may block legitimate remote/self-service users), tighten EBS responsibility and role assignments to enforce least privilege for low-tier accounts (trade-off: requires access-review effort and may disrupt users relying on over-broad roles), and increase monitoring/auditing of E-Business Tax data changes to detect unauthorized create/delete/modify activity. Do not rely on these controls as a permanent substitute for the CPU.